Is this file a flase positive? Malware.AI.489150954

[szatkoff]

Malwarebytes reports is as Malware.AI.489150954, C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\TEMPORARY ASP.NET FILES\OWA\39DBA043\4E0B7B81\APP_WEB_OUTLOOKEN.ASPX.F5DBA9B9.AJOF3BZU.DLL, No Action By User, 1000000, 0, 1.0.49502, F92E69D2489BE9F31D27D9EA, dds, 01586533, EDC927F06990C55ADC1E75244376B971, 400E82942F21EAF5DC56CB4CEB8A01D5A540F7120CA8434F2536A50E57212704

 

See attached.

App_Web_outlooken.aspx.f5dba9b9.ajof3bzu.zip

[shadowwar]

This doesnt seem to be a false positive. Is the exchange server up to date with patches?

 

Edited January 7, 2022 by shadowwar

[szatkoff]

Thanks for your response. Yes, It has the latest CU and security update. Malwarebytes also discovered the following on 1/3 and sent that to quarantine. See attached.

Backdoor.Hafnium.Shell, C:\INETPUB\WWWROOT\ASPNET_CLIENT\RTIAF.ASPX, Quarantined, 15947, 926887, 1.0.49332, , ame, , 125825D6935503C434A6D364505D46AE, A5043E8F75E48455E7409555809E32D3598E3A19300F62DD49B8BFB1926FDB17

8f36abd6-6c6c-11ec-a04f-00155d12617a.zip

[szatkoff]

I also see this?

 

[shadowwar]

That def was created in march of last year. Looks like it may be under attack. I would double check the patches and/or contact our business support team

 

[szatkoff]

I also see this?

 

[szatkoff]

Sorry, that last one is a duplicate.

 

Which file are you referring to?

[shadowwar]

please contact business support. 

[Porthos]

@szatkoff

I would highly suggest that you open a support ticket with Business Support to work with them directly.

Submit Support Ticket

It can take a few days for a response as ticket volume is high at this time.

[szatkoff]

Thanks, I have contacted support.

[szatkoff]

So what's the trick to getting a response from support? I created a case on the 7th and have not heard back?

 

 

[Porthos]

1 hour ago, szatkoff said:

So what's the trick to getting a response from support? I created a case on the 7th and have not heard back?

It has only been 5 business days. Be advised it can take 3-7 weekdays for a response after the automated reply with your ticket number.

Support is done first in first out basis. If you created more than one ticket it will delay the response.

Please post tour ticket number and I will have someone look into it.